The data plane is the path used to access a resource’s capabilities or the data it contains. It is distinct from the control plane, which manages the Azure resource itself. Creating a storage account is a control-plane operation; reading blob data from that account is a data-plane operation. section 2.3.2 section 9.1.2
This separation matters for least privilege. A principal can receive permission to view or manage a resource without automatically receiving permission to read its underlying data. For example, a Reader at the resource-group scope can view a storage account but cannot, by default, read stored data. Azure RBAC represents control-plane permissions with actions and notActions, and data-plane permissions with dataActions and notDataActions. section 2.3.2 section 2.3.2
Treat the planes as separate security and audit concerns:
- Grant data permissions only when a principal needs to use data or a resource capability, rather than merely manage or view the resource. section 2.3.2
- Use scope to limit a principal to the resources it needs, reducing the possible effect of a compromised identity. section 2.3.2
- Review resource logs for data-plane activity; Azure activity logs record control-plane operations instead. section 9.1.2 section 9.1.2
Resource management versus resource use
Creating an Azure VM belongs to the control plane. Connecting to that VM through Remote Desktop Protocol uses the data plane. Similarly, an application can create a storage account through the control plane and later read blob data through the data plane. section 9.1.2 section 9.1.2
az role definition list --name "Virtual Machine Contributor"
Inspect an Azure RBAC role definition to identify its permission properties, then distinguish actions from dataActions when assessing management access versus data access. section 2.3.2
